CTF WP – 工控业务流量分析

赛题描述

       这是我们工厂中在某天下午截取的数据包,请找出流量中针对正常的业务不对劲的数据内容。附件下载地址

解题思路

       该题目为工控业务流量分析,属于数据包分析类的题目,使用wireshark打开下载到的数据包后可以发现数据包中有大量的数据混杂在一起,考虑到题目是工控业务流量分析,因此可以初步排除非工控的协议,留到最后分析。

       经过逐步排除后可以发现,数据包中相关的工控流量有TCP 502端口的Modbus-TCP协议及TCP端口102的西门子S7comm协议。如下图所示,可以看到该流量中存在大量的重传现象,因此一种可能是网络中存在中间人攻击,传输的流量可能被截取篡改,而篡改的数据包中就很有可能存在我们需要的flag。

       此时可以将过滤后的数据包使用wireshark导出后用scapy工具进行辅助分析是否存在中间人改包及定位数据包位置。

       通过辅助分析后,并没有在数据包中发现被篡改的数据,因此可以排除中间人改包的这个可能。怀疑造成数据包显示大量重放的原因可能与端口镜像配置有关。

       如果Flag存在工控协议中的话,那么留下的可能性不多,只需要进一步关注modbus协议及西门子S7协议的数据包即可。

       使用wireshark进一步分析西门子s7协议的数据包后发现存在大量的read var和write var请求。

       但是进一步分析后会发现大量的readvar和writevar都是针对同一个数据进行的读取行为,且数据本身长度较小且没有变化。因此也可以大致排除西门子s7comm中存在flag的可能。

       下一步需要分析的就是modbus协议了, 通过对modbus协议进行过滤,首先分析所有使用到的modbus功能码,目前发现数据包中使用到了0x01(Read coils),0x03(Read Holding Registers) 0x0f (Write multiple coils)。

       通过对这些功能码所相关的数据进行分析后可以发现,数据包中存在大量的Read Holding Registers请求, 且请求的各个寄存器数值一直在不停的变化,看起来比较像正常的工业数据,而Read coils请求及Write multiple coils请求只出现了一次,因此比较可疑。 数据包中的modbus write multiple coils写入了168个连续的bit数据,我们所需要的flag信息就可能藏在这里。

mobus tcp的bit位写入在数据包的传输方式有些特殊,具体可以参考官方资料。

 

       编写脚本处理coils信息,执行后得到Flag: CyberWorldCupCETC2018

原创作者:DARK_LBP,转载请注明来自 工匠安全实验室

发表评论

电子邮件地址不会被公开。 必填项已用*标注

评论列表(9条)

  • MatBittee 2019年3月11日 02:41

    Cialis Rush Order Gabapentin Overnight Delivery Solar A Propecia cialis On Line Le Iene Viagra Generico

  • nike flyknit racer 2019年3月18日 14:44

    I wanted to post a brief word to express gratitude to you for these splendid tactics you are giving on this website. My time intensive internet research has at the end been compensated with extremely good content to exchange with my great friends. I would claim that we visitors actually are unequivocally lucky to live in a notable community with very many marvellous people with very beneficial principles. I feel rather fortunate to have come across your entire web page and look forward to really more enjoyable minutes reading here. Thanks once more for a lot of things.
    nike flyknit racer [url=http://www.nikeflyknit.us.com]nike flyknit racer[/url]

  • golden goose sneakers 2019年3月19日 20:00

    I wanted to write down a brief remark to thank you for these amazing recommendations you are placing on this website. My particularly long internet research has at the end of the day been honored with reliable insight to write about with my family. I would believe that we site visitors actually are really fortunate to exist in a fabulous place with so many awesome people with beneficial techniques. I feel very much blessed to have used your site and look forward to really more enjoyable times reading here. Thank you again for a lot of things.
    golden goose sneakers

  • michael kors handbags sale 2019年3月21日 04:28

    I simply desired to thank you very much once again. I do not know the things I would’ve followed in the absence of the actual advice provided by you about my subject. It seemed to be a real frightening situation for me, however , coming across the very specialised technique you handled the issue forced me to weep for happiness. Extremely grateful for this guidance and thus sincerely hope you comprehend what a powerful job you were accomplishing teaching most people by way of your blog post. Most likely you’ve never met all of us.
    michael kors handbags sale

  • nike air force 1 low 2019年3月22日 09:38

    I’m also commenting to make you know what a perfect experience my daughter enjoyed reading yuor web blog. She learned a wide variety of issues, most notably what it’s like to possess an ideal giving spirit to make a number of people without hassle fully grasp a variety of specialized issues. You truly surpassed our own desires. Thanks for distributing these powerful, dependable, revealing and unique tips on that topic to Mary.
    nike air force 1 low

  • balenciaga triple s 2019年3月23日 22:18

    Thank you a lot for providing individuals with such a marvellous opportunity to read from this site. It’s always so excellent and as well , packed with a lot of fun for me and my office co-workers to visit your blog nearly three times in one week to learn the latest tips you will have. Not to mention, I’m also usually fulfilled with your beautiful creative ideas you give. Some two points on this page are basically the finest I have ever had.
    balenciaga triple s

  • adidas ultra boost 2019年3月24日 12:27

    I definitely wanted to write down a brief remark to be able to express gratitude to you for all the wonderful secrets you are posting at this website. My time intensive internet look up has at the end of the day been honored with beneficial points to talk about with my friends and family. I ‘d express that we readers actually are very endowed to be in a fine community with very many perfect individuals with good principles. I feel really blessed to have come across the webpages and look forward to some more thrilling times reading here. Thank you again for all the details.
    adidas ultra boost

  • yeezy wave runner 700 2019年3月25日 04:42

    I’m just commenting to make you be aware of what a fantastic experience my cousin’s girl enjoyed studying your web site. She came to understand a lot of issues, which include what it’s like to have a great teaching style to get the mediocre ones very easily have an understanding of chosen impossible subject areas. You undoubtedly did more than visitors’ expectations. Many thanks for supplying such insightful, dependable, edifying as well as fun tips on the topic to Sandra.
    yeezy wave runner 700

  • adidas superstar shoes 2019年3月26日 09:12

    I definitely wanted to write a message so as to thank you for those stunning secrets you are giving out here. My incredibly long internet lookup has at the end of the day been recognized with wonderful tips to share with my friends and family. I ‘d mention that most of us readers are truly endowed to be in a very good community with many marvellous people with valuable principles. I feel very privileged to have discovered the weblog and look forward to many more exciting times reading here. Thanks a lot once more for everything.
    adidas superstar shoes

联系我们

18620368203

在线咨询:点击这里给我发消息

邮件:[email protected]

QR code